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An automation aystem (1) , comprising at least 
• a bus system |(2) , 

- I/O bus subscjriberfi (31 - 38) connected to it and 
a standard control device (4; 40, 41), as well as 

- at least one nafety analyzer (5, 5, 5^") which 
monitors the data flow via the bus system and is 
designed to carry oul; at least one safety-related 
function, 

characterized in that 

the safety anal/zer is set up for checking and 
processing safety- re .ated data in the bus datastream 
and/or has a device for manipulating the datastream 
transmitted on the mis (2) . 



20 



The automationleystem^^) as qlaimed in claim 1, 
characterized jin tha^ 

role at least one 

safety- related Output, 



25 



30 



The automation system (1) as claimed in claim 1 or 



2, 



characterizec 



in that 



the safety analyzer (5, 5', 5") has a freely 
programmable logit device, which processes the monitored 

data, in particular the monitored safety- related data. 

I 
I 

The automat i'on system (1) as claimed in one of 

i 

claims 1 to 3, 

characterized in that 
the safety analyzer (5, 5', S'') is not a logic bus 
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subscriber in the automation system ID and has at least 
one safety-related output (6) via which at least one 
assembly, which is assodiated with the safety analyzer, 
of the automation systerl in particular at least one bus 
5 subscriber (31 - 38), cah be switched on or off. 

S, The automation system (1) as claimed in claim 4, 

characterized in thc.t 

the safety analyzer '; (5, 5', 5'^) is set up for 
switching off a safety inland, a bus spur (8) and/or the 



10 



entire system. 



6. The automation system as claimed in one of claims 1 

to 5, j 
15 characterized in tt^at 

the safety analyze* (5') hpr^atl^ast one safety- 
related input (10). via| which ythe safety analyzer is 
connected to a safety-related' device y(NsJ^_in__^g^ — 
automation system for ^etectang saf/ty- related data. 



The automation system (1) as claimed in one of 



20 ! 



claims 1 to 6, I 

characterized in j:hat 

the bus system (21 is connected via an interface 
25 assembly (41) to a host (40) , with the process-related 

control being arrange^ in the host, and the safety- 
related control being,' arranged in the interface 
assembly- j 

I 

30 8. The automation system (1) as claimed in one of 

/ 

claims 1 to 7, ; 

characterized that 
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the bus (2) is a se|-ial bus, and at least one 
safety analyzer (5, 5') arranged in the long-distance 
bus section of the autoijlation system. 

; 

The automation syejtem (1) as claimed in claim 8, 
characterised in t^hat 

a safety analyzer^' (5) is arranged directly after 

the host (40) or aft ex/ the interface assembly (41) . 

I 
I 

/ 

The automation ^stem (1) as claimed in one of 
claims 1 to 9, / 

characterized in that 

a safety anal]^zer (5) is arranged in the interface 
assembly (41) . j 

I 

The automation system (1) 
preceding claims/ 1 to 10 « 

characterised in that 

the Gatetyj analyzer ( ^ 
device for storing a process m^. 




claimed in one of the 



compriees a memory 



The autonjation system (1) as claimed in one of the 
preceding claims 1 to 11, 
characterized in that 

the safety analyzer (5, 5', 5") has a device for 
manipulating the input and/ or output data transmitted on 
the bus (2) . 

The autmation system (1) as claimed in claim 12, 
characterized in that 

the deviie overwrites input and/or output data in 
the safety analyzer (5, 5\ 5"), and/or inserts data 
into the datastVeam, 
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15, 



16. 



17. 



The automktion system (1) as claimed in one of the 
preceding claimlB 1 to 13, 
characterized in that 

at least one safety analyzer (5, 5", 5") is of 
rediandant design. 

\ 

A method for operating an automation system, in 
particular an autcmation system (1) as claimed in one of 
claims 1 to 14, 

in that 

a standard cohtrol device (4; 40, 41) carries out a 
process control with the procee&ing of process-linked 
I/O data and safet^r-related control with the processing 

iata, and, furthermore, processing of 
safety- related data is carried out i^'^tXleaet one 
safety analyzer (5, 5'. 5"), with/safety- related data, 
in particular safety-related lo«.c linking data in the 
bus datastreara, bring processed/in thel safety analyzer. 



The method a i 
characterized 
the standard 
safety-related ou 



The method a^ 
characterize 
a comparison 



in claim 15 r \^ 



claimed in 
in that 

control device controls at least one 
put. 



claimed in claim 15 or IS, 
in that 

of the safety- related logic linking 



data, which is tr ansmitted via the bus, for the standard 



control device (4 
safety analyzer (I 



41) and/or of at least one further 
, 5", 5") with the corresponding 



logic linking datJ of the first safety analyzer, is 
carried out in a safety analyzer (S, 5', 5'"). 
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The method as claimed in one of claims IS to 17, 
charactWized in that 

the logi\ linking data, which ie produced by the 
standard control (4, 41) and is sent as output data via 
the bus, ia choked in at least one eafety analyzer (5, 
5', 5") by modeling the eafety-related logic links of 
the standard coi^rol (4, 41) . 

The method as claimed in one of claims 15 to 18, 
characterize^d in that 

safety- related functions are carried out in 
response to the cjheck or the comparison by the safety 
analyzer (5, 5", 



5-), 



The method is claimed in 
characteriz 5d in that 
a safety-rdlated func 
safety-related <^utput (6)^ 




claims 15 to 19, 



is carried out via a 
e safety analyzer (5, 5', 



25 



21. 



30 



22. 



The methoA as claimed in one of claims 15 to 20, 
characterized in that 

the safetKr analyzer carries out safety-related 
functions in rfesponse to the safety-related data 
detected via {[he safety-related input (10) of the safety 
analyzer (5') ! 



The method as claimed in claim 21, 
characterized in that 

the process of carrying out the safety- related 
function compiUses switching at least one assembly in 
the automationlbus system, in particular a bus 
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subscriber 132 - 38), on or off, 



23 
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27, 



The metlipd as claimed in one of claims 15 to 22, 
characterized in that 

the safety analyzer (5', B"") overwrites or deletes 
at least one data item in the datastream and/or inserts 
at least one dajta item into the bus datastream by means 
of a device forj manipulating the datastream an the bus 
(2) • 



The method 



as claimed in claim 23, 



characterised in that 

the safety analyzer (5, 5', 5'') at least partially 
stores the monitored datastream and copies input data in 
the bus datastrekms to output data in the bus 
datastream, and /ice versa. 



The method 
characterizjed 
safety 
using a securit> 



3is claimed in oi)e of 9^.aime 15 to 24, 
in that 



related data is transmitted Via the bus (2) 



The method 
characteri: 
in addition 



protocol . 



as claimed in claim 25, 
;ed in that, 
to the safety data item, the sec\irity 
protocol compriues the negated safety data item, a 
sequential number, an address and/or data protection 
information (CRj;) . 

The method! as claimed in one of claims 15 to 26, 
characterized in that 

the bus is la system operating an the master-slave 



V 
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principle, wVth data being transmitted between at least 
two slaves, iVi particular between individual bus 
subscribers (31 - 38)/ by means of a data link via at 
least one safety analyzer (5 5% 5''), with the safety 
analyzer copying data in the bus datastream. 



10 



15 



20 



28. 



29. 



The method! as claimed in one of claims 15 to 27, 
characterised in that 



the bus is 
principle, with 



a system operating on the master- slave 
data being transmitted between at least 



two slaves, in particular between individual bus 



subscribers (31 



copying data in 



The method 



38), by means of a data link via the 



control or the ^ster, with the control or the master 



the bus datastream. 



as claimed in op€^f claims 15 to 28, 
characteriized in that 

quality dajta is producel& byjUeans of a safety 
analyzer (5, s], 5''), and/br tW^^^tajjb^^ been 
read is prepared for furthir ^tocessing. 



30. The methoi as claimed in one of claims 15 to 29, 

characterized in that 

the safet^r-related logic links used in a safety 
25 analyzer (5') feire at least partially carried out in 

redundant forrt^ in at least one further safety analyzer 
(5''), and th€j same safety functions are at least 
partially carried out by the two safety analyzers. 

30 31. The methqd as claimed in one of claims 15 to 30, 



characterized 



in that 



a safety analyzer also at least partially carries out 
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process data processing. 




